.TH syslog\-ng\-ctl 1 "03 September 2025" 4.9.0 "The syslog\-ng OSE control tool manual page"
.SH NAME
.PP
syslog\-ng\-ctl \-\-\- Display message statistics and enable verbose, debug and trace modes in {{ site.product.short_name }}
.SH Synopsis
.PP
syslog\-ng\-ctl [command] [options]
.SH Description
.PP
\fBNOTE:\fP The syslog\-ng\-ctl application is distributed with the syslog\-ng OSE
system logging application, and is usually part of the syslog\-ng OSE
package. The latest version of the syslog\-ng OSE application is
available at the syslog\-ng OSE page.
.PP
This manual page is only an abstract.
.PP
The syslog\-ng\-ctl application is a utility that can be used to:
.RS
.IP \(bu 2
enable/disable various syslog\-ng OSE messages for troubleshooting
.IP \(bu 2
display statistics about the processed messages
.IP \(bu 2
handling password\-protected private keys
.IP \(bu 2
display the currently running configuration of syslog\-ng OSE
.IP \(bu 2
reload the configuration of syslog\-ng OSE.
.RE
.SH Enabling troubleshooting messages
.PP
command [options]
.PP
Use the syslog\-ng\-ctl <command> \-\-set=on command to display verbose,
trace, or debug messages. If you are trying to solve configuration
problems, the verbose (and occasionally trace) messages are usually
sufficient. Debug messages are needed mostly for finding software
errors. After solving the problem, do not forget to turn these messages
off using the syslog\-ng\-ctl <command> \-\-set=off Note that enabling
debug messages does not enable verbose and trace messages.
.PP
Use syslog\-ng\-ctl <command> without any parameters to display whether
the particular type of messages are enabled or not.
.PP
If you need to use a non\-standard control socket to access syslog\-ng OSE,
use the syslog\-ng\-ctl <command> \-\-set=on \-\-control=<socket>
command to specify the socket to use.
.RS
.IP \(bu 2
verbose
.PP
Print verbose messages. If syslog\-ng OSE was started with the
\-\-stderr or \-e option, the messages will be sent to stderr. If not
specified, syslog\-ng OSE will log such messages to its internal
source.
.IP \(bu 2
trace
.PP
Print trace messages of how messages are processed. If syslog\-ng OSE
was started with the \-\-stderr or \-e option, the messages will be
sent to stderr. If not specified, syslog\-ng OSE will log such
messages to its internal source.
.IP \(bu 2
debug
.PP
Print debug messages. If syslog\-ng OSE was started with the
\-\-stderr or \-e option, the messages will be sent to stderr. If not
specified, syslog\-ng OSE will log such messages to its internal
source.
.RE
.SS Example
.PP
.RS
.nf
syslog\-ng\-ctl verbose \-\-set=on
.fi
.RE
.SH syslog\-ng\-ctl query
.PP
The syslog\-ng OSE application stores various data, metrics, and
statistics in a hash table. Every property has a name and a value. For
example:
.PP
.RS
.nf
[syslog\-ng]
|              
|_[destinations]\-[network]\-[tcp]\->[stats]\->{received=12;dropped=2}
|
|_[sources]\-[sql]\-[stats]\->{received=501;dropped=0}
.fi
.RE
.PP
You can query the nodes of this tree, and also use filters to select the
information you need. A query is actually a path in the tree. You can
also use the ? and * wildcards. For example:
.RS
.IP \(bu 2
Select every property: *
.IP \(bu 2
Select all dropped value from every stats node: *\&.stats.dropped
.RE
.PP
The nodes and properties available in the tree depend on your syslog\-ng OSE configuration (that is, the sources, destinations, and other objects
you have configured), and also on your stats\-level() settings.
.SH The list command
.PP
syslog\-ng\-ctl query list
.PP
Use the syslog\-ng\-ctl query list command to display the list of metrics
that syslog\-ng OSE collects about the processed messages.
.PP
An example output:
.PP
.RS
center.received.stats.processed
center.queued.stats.processed
destination.d\fIelastic.stats.processed
source.s\fPtcp.stats.processed
source.severity.7.stats.processed
source.severity.0.stats.processed
source.severity.1.stats.processed
source.severity.2.stats.processed
source.severity.3.stats.processed
source.severity.4.stats.processed
source.severity.5.stats.processed
source.severity.6.stats.processed
source.facility.7.stats.processed
source.facility.16.stats.processed
source.facility.8.stats.processed
source.facility.17.stats.processed
source.facility.9.stats.processed
source.facility.18.stats.processed
source.facility.19.stats.processed
source.facility.20.stats.processed
source.facility.0.stats.processed
source.facility.21.stats.processed
source.facility.1.stats.processed
source.facility.10.stats.processed
source.facility.22.stats.processed
source.facility.2.stats.processed
source.facility.11.stats.processed
source.facility.23.stats.processed
source.facility.3.stats.processed
source.facility.12.stats.processed
source.facility.4.stats.processed
source.facility.13.stats.processed
source.facility.5.stats.processed
source.facility.14.stats.processed
source.facility.6.stats.processed
source.facility.15.stats.processed
source.facility.other.stats.processed
global.payload\fIreallocs.stats.processed
global.msg\fPclones.stats.processed
global.sdata\fIupdates.stats.processed
tag..source.s\fPtcp.stats.processed
.RE
.PP
The syslog\-ng\-ctl query list command has the following options:
.RS
.IP \(bu 2
\-\-reset
.PP
Use \-\-reset to set the selected counters to 0 after executing the
query.
.RE
.SH Displaying metrics and statistics
.PP
syslog\-ng\-ctl query get [options]
.PP
The syslog\-ng\-ctl query get <query> command lists the nodes that match
the query, and their values.
.PP
For example, the destination query lists the configured destinations,
and the metrics related to each destination. An example output:
.PP
.RS
destination.d_elastic.stats.processed=0
.RE
.PP
The syslog\-ng\-ctl query get command has the following options:
.RS
.IP \(bu 2
\-\-sum
.PP
Add up the result of each matching node and return only a single
number.
.PP
For example, the syslog\-ng\-ctl query get \-\-sum
\[rs]"destination*\&.dropped\[rs]" command displays the number of messages
dropped by the syslog\-ng OSE instance.
.IP \(bu 2
\-\-reset
.PP
Use \-\-reset to set the selected counters to 0 after executing the
query.
.RE
.SH The stats command
.PP
stats [options]
.PP
Use the stats command to display statistics about the processed
messages. For details about the displayed statistics,
see The syslog\-ng OSE Administration Guide.
The stats command has the following options:
.RS
.IP \(bu 2
\-\-control=<socket> or \-c
.PP
Specify the socket to use to access syslog\-ng PE. Only needed when
using a non\-standard socket.
.IP \(bu 2
\-\-reset=<socket> or \-r
.PP
Reset all statistics to zero, except for the queued counters. (The
queued counters show the number of messages in the message queue of
the destination driver, waiting to be sent to the destination.)
.IP \(bu 2
\-\-remove\-orphans
.PP
Safely removes all counters that are not referenced by any syslog\-ng
stat producer objects.
.PP
The flag can be used to prune dynamic and static counters manually.
This is useful, for example, when a templated file destination
produces a lot of stats:
.PP
.RS
dst.file;#anon\-destination0#0;/tmp/2021\-08\-16.log;o;processed;253592
dst.file;#anon\-destination0#0;/tmp/2021\-08\-17.log;o;processed;156
dst.file;#anon\-destination0#0;/tmp/2021\-08\-18.log;a;processed;961
.RE
.PP
\fBNOTE:\fP The stats(lifetime()) can be used to do the same
automatically and periodically, but currently stats(lifetime())
removes only dynamic counters that have a timestamp field set.
.RE
.SS Example \- stats
.PP
.RS
.nf
syslog\-ng\-ctl stats
.fi
.RE
.PP
An example output:
.PP
.RS
src.internal;s\fIall#0;;a;processed;6445
src.internal;s\fPall#0;;a;stamp;1268989330
destination;df\fIauth;;a;processed;404
destination;df\fPnews\fIdot\fPnotice;;a;processed;0
destination;df\fInews\fPdot\fIerr;;a;processed;0
destination;d\fPssb;;a;processed;7128
destination;df\fIuucp;;a;processed;0
source;s\fPall;;a;processed;7128
destination;df\fImail;;a;processed;0
destination;df\fPuser;;a;processed;1
destination;df\fIdaemon;;a;processed;1
destination;df\fPdebug;;a;processed;15
destination;df\fImessages;;a;processed;54
destination;dp\fPxconsole;;a;processed;671
dst.tcp;d\fInetwork#0;10.50.0.111:514;a;dropped;5080
dst.tcp;d\fPnetwork#0;10.50.0.111:514;a;processed;7128
dst.tcp;d\fInetwork#0;10.50.0.111:514;a;queued;2048
destination;df\fPsyslog;;a;processed;6724
destination;df\fIfacility\fPdot\fIwarn;;a;processed;0
destination;df\fPnews\fIdot\fPcrit;;a;processed;0
destination;df\fIlpr;;a;processed;0
destination;du\fPall;;a;processed;0
destination;df\fIfacility\fPdot\fIinfo;;a;processed;0
center;;received;a;processed;0
destination;df\fPkern;;a;processed;70
center;;queued;a;processed;0
destination;df\fIfacility\fPdot_err;;a;processed;0
.RE
.SH Handling password\-protected private keys
.PP
syslog\-ng\-ctl credentials [options]
.PP
The syslog\-ng\-ctl credentials status command allows you to query the
status of the private keys that syslog\-ng OSE uses in the network() and
syslog() drivers. You can also provide the passphrase for
password\-protected private keys using the syslog\-ng\-ctl credentials add
command. For details on using password\-protected keys, see
The syslog\-ng OSE Administrator Guide.
.SH Displaying the status of private keys
.PP
syslog\-ng\-ctl credentials status [options]
.PP
The syslog\-ng\-ctl credentials status command allows you to query the
status of the private keys that syslog\-ng OSE uses in the network() and
syslog() drivers. The command returns the list of private keys used, and
their status. For example:
.PP
.RS
.nf
syslog\-ng\-ctl credentials status
.fi
.RE
.PP
.RS
Secret store status:
/home/user/ssl_test/client\-1/client\-encrypted.key SUCCESS
.RE
.PP
If the status of a key is PENDING, you must provide the passphrase for
the key, otherwise syslog\-ng OSE cannot use it. The sources and
destinations that use these keys will not work until you provide the
passwords. Other parts of the syslog\-ng OSE configuration will be
unaffected. You must provide the passphrase of the password\-protected
keys every time syslog\-ng OSE is restarted.
.PP
The following log message also notifies you of PENDING passphrases:
.PP
.RS
Waiting for password; keyfile='private.key'
.RE
.RS
.IP \(bu 2
\-\-control=<socket> or \-c
.PP
Specify the socket to use to access syslog\-ng OSE. Only needed when
using a non\-standard socket.
.RE
.SH Opening password\-protected private keys
.PP
syslog\-ng\-ctl credentials add [options]
.PP
You can add the passphrase to a password\-protected private key file
using the following command. syslog\-ng OSE will display a prompt for you
to enter the passphrase. We recommend that you use this method.
.PP
.RS
.nf
syslog\-ng\-ctl credentials add \-\-id=<path\-to\-the\-key>
.fi
.RE
.PP
Alternatively, you can include the passphrase in the \-\-secret
parameter:
.PP
.RS
.nf
syslog\-ng\-ctl credentials add \-\-id=<path\-to\-the\-key> \-\-secret=<passphrase\-of\-the\-key>
.fi
.RE
.PP
Or you can pipe the passphrase to the syslog\-ng\-ctl command, for
example:
.PP
.RS
.nf
echo "<passphrase\-of\-the\-key>" | syslog\-ng\-ctl credentials add \-\-id=<path\-to\-the\-key>
.fi
.RE
.RS
.IP \(bu 2
\-\-control=<socket> or \-c
.PP
Specify the socket to use to access syslog\-ng PE. Only needed when
using a non\-standard socket.
.IP \(bu 2
\-\-id=<path\-to\-the\-key> or \-i
.PP
The path to the password\-protected private key file. This is the
same path that you use in the key\-file() option of the syslog\-ng OSE
configuration file.
.IP \(bu 2
\-\-secret=<passphrase\-of\-the\-key> or \-s
.PP
The password or passphrase of the private key.
.RE
.SH Displaying the configuration
.PP
syslog\-ng\-ctl config [options]
.PP
Use the syslog\-ng\-ctl config command to display the configuration that
syslog\-ng OSE is currently running. Note by default, only the content of
the main configuration file are displayed, included files are not
resolved. To resolve included files and display the entire
configuration, use the syslog\-ng\-ctl config \-\-preprocessed command.
.SH Reloading the configuration
.PP
syslog\-ng\-ctl reload [options]
.PP
Use the syslog\-ng\-ctl reload command to reload the configuration file of
syslog\-ng OSE without having to restart the syslog\-ng OSE application.
The syslog\-ng\-ctl reload works like a SIGHUP.
.PP
The syslog\-ng\-ctl reload command returns 0 if the operation was
successful, 1 otherwise.
.SH Files
.PP
/opt/syslog\-ng/sbin/syslog\-ng\-ctl
.PP
\fBNOTE:\fP
If you experience any problems or need help with syslog\-ng OSE, see the \fIsyslog\-ng OSE Administration Guide\fP[1], or visit the \fIsyslog\-ng OSE mailing list\fP[2].
For news and notifications about syslog\-ng OSE, visit the \fIsyslog\-ng OSE blogs\fP[3].
.SH AUTHOR
.PP
This manual page was generated from the \fIsyslog\-ng OSE Administration Guide\fP[1], which was written by several contributors to whom we'd like to extend our sincere thanks.
.SH COPYRIGHT
.SH NOTES
.PP
[1] \fB\fCsyslog\-ng OSE Administration Guide\fR
    \[la]https://syslog-ng.github.io/admin-guide/README\[ra]
.PP
[2] \fB\fCsyslog\-ng OSE mailing list\fR
    \[la]https://lists.balabit.hu/mailman/listinfo/syslog-ng\[ra]
.PP
[3] \fB\fCsyslog\-ng OSE blogs\fR
    \[la]https://syslog-ng.com/blog/\[ra]
